Oracle Health (Cerner) legacy server breach of early 2025 reportedly hit nearly 20 million people, per Bloomberg citing a Texas attorney general report; Texas lists 2,992,244 affected Texans, and Oracle has not confirmed a total
Bloomberg reported on 5 October 2026, citing a report from the Texas attorney general, that personal and medical information of nearly 20 million people was compromised in the attack on Oracle Health's legacy Cerner systems, far above counts in earlier filings and patient letters. SecurityWeek notes that Cerner's entry on the Texas attorney general's data breach portal, published on 2 October 2026, lists 2,992,244 affected Texans, with South Carolina and Washington filings listing roughly 283,000 and 69,000 residents. Oregon filings give 22 January to 1 April 2025 as the breach period and 20 February 2025 as the discovery date. Oracle told healthcare customers in March 2025 that an attacker had used stolen customer credentials to reach an old Cerner server not yet migrated to Oracle Cloud and copied data off it. A sample letter filed in California lists names, Social Security numbers and medical record data including medical record numbers, doctors, diagnoses, medicines, test results, images and treatment. An individual extortionist calling themselves 'Andrew' demanded cryptocurrency from affected hospitals. Oracle has not given a public total and declined to comment to Bloomberg; the 20 million figure is not yet confirmed by Oracle. No Australian impact has been reported. Wire: SecurityWeek, citing Bloomberg.
- Product
- Oracle Health (formerly Cerner) legacy EHR data server
- Versions
- n/a
- Exploited in Australia?
- unknown
- Patch to
- Healthcare customers of Oracle Health: confirm whether your data sat on legacy Cerner servers and whether your patients have been notified. Generally: enforce MFA on vendor-hosted systems, rotate customer credentials after any vendor incident, and treat unmigrated legacy servers as in-scope for monitoring.
Primary: SecurityWeek — Oracle Health data breach tally climbs to nearly 20 million (8 Oct 2026) · Vendor: Bloomberg — Oracle 2025 health breach compromised data of 20 million people (5 Oct 2026; may be paywalled) · Texas Attorney General — data security breach reports portal (Cerner entry, 2 Oct 2026)